CVE-2026-23112 Details
Description
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec nvmet_tcp_build_pdu_iovec() could walk past cmd->req.sg when a PDU length or offset exceeds sg_cnt and then use bogus sg->length/offset values, leading to _copy_to_iter() GPF/KASAN. Guard sg_idx, remaining entries, and sg->length/offset before building the bvec.
A vulnerability in the Linux kernel's NVMe over TCP target driver could lead to a general protection fault or a use-after-free error, as detected by the Kernel Address Sanitizer. The issue arises in the 'nvmet_tcp_build_pdu_iovec' function, which can improperly access scatter-gather list entries when the Protocol Data Unit (PDU) length or offset exceeds the available entries. This mismanagement can cause the function to read invalid length or offset values, disrupting memory operations and potentially leading to memory corruption.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. Instructions for upgrading the Linux kernel can be found in the official Linux documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.0, < 5.10.250 >= 5.11, < 5.15.200 >= 5.16, < 6.1.163 >= 6.2, < 6.6.124 >= 6.7, < 6.12.70 >= 6.13, < 6.18.10 6.19 rc1 6.19 rc2 6.19 rc3 6.19 rc4 6.19 rc5 6.19 rc6 6.19 rc7 6.19 rc8 |
CPE
Remediation
| |
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | siemens-SADP |
| Jun 2, 2026 | CVE Modified | siemens-SADP |
| May 4, 2026 | CVE Modified | kernel.org |
| Apr 3, 2026 | CVE Modified | kernel.org |
| Mar 19, 2026 | Reanalysis | [email protected] |
| Mar 18, 2026 | Initial Analysis | [email protected] |
| Feb 13, 2026 | New CVE Received | kernel.org |